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IN THE CLA IMS 
Amended claims follow: 

1 . (Currently Amended) A computer program produc t embodied on a comp uter 
readable medium for controlling a mobile data processing device to update malware 
definition data for a malware scanner of said mobile data processing device, said 
computer program product comprising; 

(i) link establishing code operable to establish a wireless telephony link between 
said mobile data processing device and a public wireless telephony network; 

(ii) update receiving code operable to receive malware definition updating data at 
said mobile data processing device via a data channel of said wireless telephony link; and 

(iii) malware definition updating code operable to update malware definition data 
stored upon said mobile data processing device using said malware definition updating 
data^ 

wherein said mobile data processin g device registers with a hase station of said 
wireless telephony network when said link is esta b lished sucb that sa jd base station and 
s aid wireless telephony network are notified o f a telenhn™ number of said mobile ri**, 
processing device for use In sending yr .^ ware definition updating data te said mobile 
data processing devi ce; 

wherein when received data is receiv ed at said mobile data processing device, a 
t ype of said received data is identified to de te rmine if said received data is said malware 
definition updating data, such that if said re c eived data is said malware defin ition^ 
. updating data, a digital signature associate d with .said malware definition updating data is 
verified: 

wherein if said digital signature is not verified, said malw^ definition up dating 
data is ig nored- 

wherein if said digital signature is ver ified, said malware definition updating data 
jsu tilized to update said malware definition dat a Stored unon said mobile data processing 
device by appending said malware definitio n updating date to said malware definition 
data; 
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Wheiein SWd malware definition undar jae data is provided in a malware definit ^ 
upd ating , file, where said file is generated hv on* of automatically, semi-automaticallv. 
and manually upon an analysis of newlv disco v ered malware and where said file mchyAe* 
a detection fingerprint and at least one of a removal action and a disinfection action to he 
taken in response to a detection of s aid newlv discovered malware- 

wherein said mobile data proces sing device is identified bv a database of 
subscribers to an update service associated with said malware scanner, where saiH 
database includes said telephone number of s a id mobile data processing device to which , 
said malware definition up d ating data is to be sent and a , t ype of said mobile data 
processing device such that only malware d efinition updating data that is appropriate to 
said type of said mobile data processing d evice is sent to said mobile data processing 
device. 



2. (Original) a computer program product as claimed in claim 1, wherein said 
mobile data processing device is a mobile telephone. 

3 . (Original) A computer program product as claimed in claim 1 , wherein said 
mobile data processing device is a personal digital assistant having a connection to said 
wireless public telephony network. 



4. (Cancelled) 



5. (Original) A computer program product as claimed in claim 1, wherein said 
public wireless telephone network is one of a CDMA network and a GSM network. 

6. (Original) A computer program product as claimed in claim 1, wherein said data 
channel is also used for passing text messages. 

7. (Original) A computer program product as claimed in claim 6, wherein said text 
messages are SMS messages. 
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8. (Currently Amended) A computer program product as claimed in claim 1 , 
wherein said step of tranaforrinereceiving malw a re definition np Hatmp *„t a j s initiated 
from a source of said malware definition updating data. 

9. (Original) A computer program product as claimed in claim 1, wherein said data 
channel is open whenever said mobile data processing device is switched on and 
connected to said public wireless telephony network. 



1 0. (Currently Amended) A computer program produc t embodied on a comp ute 
readable medium for controlling a computer to initiate updating of malware definition 
data for a malware scanner of a mobile data processing device, said computer program 
product comprising; 

(i) link estabHshing code operable to establish a wireless telephony link to said 
mobile data processing device via a public wireless telephony network; and 

(ii) update sending code operable to send malware definition updating data to said 
mobile data processing device via a data channel of said wireless telephony link; 

wherein said mobile data nrnc essing device registers with a base station nfgairi 
wireless telephony network when said link j s established such that said hase station and 
said wireless telephony network are notifie d of a telephone number of sajd mobile data 
processing device for use in sending said m alware definition updating data to said mobile 
data processing device; 

wherein when received data is re ceived at said mobile data processing device, a 
type of said received data is identified t o determine if said received data is said malware 
definition updating data, such that if said r e ceived data is said malware de.finiti™ 
updating data, a digital signature associat e d with said malware definition updating data 1« 
verified; 

wherein if said digital signatur e is not verified, said malware definition updatinp 
data is ignored: 

.wherein if said digital signature is verified mid mal ware definition updating data 
is utilised to update malware definition data stored upon said mobile data p mr-t^inp 
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device by appending said malware definition updating data to said malware definition 
data; 

wherein said malware definition updating data is provided in a malware definition 
updating file, where said file is generated bv one of a utomatically, semi-automaticallv, 
and manually upon an analysis of newly discovered malware and where said file includes 
a detection fingerprint, and at least one of a removal action and a disinfection action to be 
taken m response to a detection of said newly discovered malware; 

wherein said mobile data processing device is identified by a database of 
subscribers to an update service associated with said malware scanner, where said 
database includes said telephone number of said mobile data processing device to which 
said malware definition updating data is to be sent and a type of said mobile data 
processing device such that only malware definition updating data that is appropriate to 
said type of said mobile data processing device is sent to said mobile data processing 
device . 

1 1 . (Original) A computer program product as claimed in claim 10, wherein said 
mobile data processing device is a mobile telephone. 

12. (Original) A computer program product as claimed in claim 10, wherein said 
mobile data processing device is a personal digital assistant having a connection to said 
wireless public telephony network. 

13. (Cancelled) 

14. (Original) A computer program product as claimed in claim 10, wherein said 
public wireless telephone network is one of a CDMA network and a GSM network. 

1 5. (Original) A computer program product as claimed in claim 1 0, wherein said data 
channel is also used for passing text messages. 

1 6> (Original) A computer program product as claimed in claim 15, wherein said text 



PAffi 1 1/23 1 RCVD AT 10113/2005 5:39:38 PM [Eastern Daylight Time] * SVR:USPTO-EFXRF-6/26 * DNK>:2738300 • CSID:4089714660 1 DURATION (mm-$s):05-20 



OCT. 1 3. 2005 2:51PM ZILKA-KOTAB, PC 

-9- 



NO. 0546 P. 12 



messages are SMS messages. 

1 7. (Original) A computer program product as claimed in claim 10, wherein transfer 
of malware definition updating data is initiated from a source of said malware definition 
updating data. 

1 8. (Original) A computer program product as claimed in claim 10, wherein said data 
channel is open whenever said mobile data processing device is switched on and 
connected to said public wireless telephony network. 

1 9. (Currently Amended) A method of updating malware definition data for a 
malware scanner of a mobile data processing device, said method comprising the steps 
of: 

(i) establishing a wireless telephony link between said mobile data processing 
device and a public wireless telephony network; 

(ii) receiving malware definition updating data at said mobile data processing 
device via a data channel of said wireless telephony link; and 

(iii) updating malware definition data stored upon said mobile data processing 
device using said malware definition updating data; 

wherein said mobile data processing device registers with a base station of said 
wireless telephony network when said link is established such that said base station and 
said wireless telephony q^wprk aye noti fied pf 3 tel ep ho ne awnto g f ^d mobite data 
processing device for use in sending said malware definition updating data to said mobile 
data processing device: 

wherein when received data is received at said mobile data processing device, a 
type of said received data is identified to determine if said received data is said malware 
definition updating data, such that if said received data is said malware definition 
updating data, a digital signature associated with said malware definition updating data is 
verified: 

wherein if said digital signature is not verified said malware definition updating 
data is ignored: 
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wherein if said digital signature is verified, said malware definition updating data 
is utilized to update said malware definition data stored upon said mobile dataprocessing 
device bv appending said malware definition updating data to said malware definition 
data^ 

wherein said malware definition updating data is provided in a malware definition 
updating file, where said file is generated bv one of automatically, semi-automaticallv. 
and manually upon an analysis of newly discovered malware and where said file includes 
a detection fingerprint, and at least one of a removal action and a disinfection action to be 
taken in response to a detection of said newly discovered malware: 

wherein said mobile data processing device is identified bv a database of 
subscribers to an update service associated with said malware scanner, where said 
database includes said telephone number of said mobile data processing device to which 
said malware definition updating data is to be sent and a type of said mobile data 
processing device such that only malware definition updating data that is appropriate to 
said tvoe of said mobile data processin g device is sent to said mobile data processing 
device . 

20. (Original) A method as claimed in claim 1 9, wherein said mobile data processing 
device is a mobile telephone. 

2 1 . (Original) A method as claimed in claim 1 9, wherein said mobile data processing 
device is a personal digital assistant having a connection to said wireless public telephony 
network, 

22. (Cancelled) 

23. (Original) A method as claimed in claim 19, wherein said public wireless 
telephone network is one of a CDMA network and a GSM network. 

24. (Original) A method as claimed in claim 19, wherein said data channel is also 
used for passing text messages. 
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25. (Original) A method as claimed in claim 24, wherein said text messages are SMS 
messages. 

26. (Original) A method as claimed in claim 1 9, wherein transfer of said malware 
definition updating data is initiated from a source of said malware definition updating 
data. 

27. (Original) A method as claimed in claim 19, wherein said data channel is open 
whenever said mobile data processing device is switched on and connected to said public 
wireless telephony network. 

28. (Currently Amended) A method of updating malware definition data for a 
malware scanner of a mobile data processing device, said method comprising the steps 
of; 

(i) establishing a wireless telephony link to said mobile data processing device via 
a public wireless telephony network; and 

(ii) sending malware definition updating data to said mobile data processing 
device via a data channel of said wireless telephony link; 

wherein said mobile data processing device registers with a base station of said 
wireless telephony network when said link is established such that said base station and 
said wireless telephony network are notified of a telephone number of said mobile data 
processing device for use in sending said malware definition updating data to said mobile 
data processing device: 

wherein when received data is received at said mobile data processing device, a 
type of said received data is identified to determine if said received data is said malware 
definition updating data, such that if said received data is said malware definition 
updating data, a digital signature associated with said malware definition updating data is 
verified: 

wherein if said digital signature is not verified, said malware definition updating 
data is ignored: 
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wherein if said digital signature is verified, said malware definition updating data 
is utilized to update malware definition data stored upon said mobile data processing 
device bv appending said malware. definition updating data to said malware definition 
data: 

wherein said malware definition updating data is provided in a malware definition 
updating file, where said file is generated bv one of automatically, semi-automaticallv. 
and manually upon an analysis of newly discovered malware and where paid file includes 
a detection fingerprint, and at least one of a removal action and a disinfection action to be 
taken in response to a detection of said newly discovered malware: 

wherein said mobile data processing device is identified by a database of 
subscribers to an update service associated with said malware scanner, where said 
database includes said telephone number of said mobile data processing device to which 
said malware definition updating data is to be sent and a type of said mobile data 
processing ; device such that only malware definition updating data that is appropriate to 
said type of said mobile data processing device is sent to said mobile data processing 
device . 

29. (Original) A method as claimed in claim 28, wherein said mobile data processing 
device is a mobile telephone. 

30. (Original) A method as claimed in claim 28, wherein said mobile data processing 
device is a personal digital assistant having a connection to said wireless public telephony 
network. 

31. (Cancelled) 

32. (Original) A method as claimed in claim 28, wherein said public wireless 
telephone network is one of a CDMA network and a GSM network. 

33. (Original) A method as claimed in claim 28, wherein said data channel is also 
used for passing text messages. 
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34. (Original) A method as claimed in claim 33, wherein said text messages are SMS 
messages, 

35 . (Original) A method as claimed in claim 28, wherein transfer of said malware 
definition updating data is initiated from a source of said malware definition updating 
data. 

36. (Original) A method as claimed in claim 2, wherein said data channel is open 
whenever said mobile data processing device is switched on and connected to said public 
wireless telephony network. 

37. (Currently Amended) Apparatus for controlling a mobile data processing device 
to update malware definition data for a malware scanner of said mobile data processing 
device, said apparatus comprising: 

(i) link establishing logic operable to establish a wireless telephony link between 
said mobile data processing device and a public wireless telephony network; 

(ii) update receiving logic operable to receive malware definition updating data at 
said mobile data processing device via a data channel of said wireless telephony link; and 

(iii) malware definition updating logic operable to update malware definition data 
stored upon said mobile data processing device using said malware definition updating 
data; 

wherein said mobile data processing device registers with a b ase station of said 
wireless telephony network when said link is established such that said base station and 
said wireless telephony network are notified of a telephone number of said mobile data 
processing device for use in sending said malware definition updating data to said mobile 
data proce gginp; device* 

wherein when received data is received at said mobile data processing device, a 
type of said received data is identified to determine if said received data is said malware 
definition updating data, such that if said received data is said tnalwaT e definition 
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updating data, a digital signature associated with said malware defirnrinn up d ating data is 
verified: 

wherein if said digital signature is not verified, said malware definition updating 
data is ignored: 

wherein if said digital signature is verified, said malware definition updating data 
is utilized to update said malware definition data stored upon said mobile data processing 
device by appending said malware definition updating data to said malware definition 
data; 

wherein said malware definition updating data is provided in a malware definition 
updating file, where said file is generated bv one of automatically, semi-automaticallv. 
and manually upon an analysis of newly discovered malware and where said file includes 
a detection fingerprint and at least one of a removal action and a disinfection action to be 
taken in response to a detection of said newly discovered malware; 

wherein said mobile data processing device is identified bv a database of 
subscribers t o an update se rvice associated with said malware scanner, where said 
database includes said telephone number of said mobile data processing device to which v 
said malware definition updating data is to be sent and a type of said mobile data 
processingjdeyice such that only malware definition updating data that is appropriate to 
said type of said mobile data processing device is sent to said mobile data processing 
device . 

38. (Original) Apparatus as claimed in claim 37, wherein said mobile data processing 
device is a mobile telephone. 

39. (Original) Apparatus as claimed in claim 37, wherein said mobile data processing 
device is a personal digital assistant having a connection to said wireless public telephony 
network. 

40. (Cancelled) 

41 . (Original) Apparatus as claimed in claim 37, wherein said public wireless 
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telephone network is one of a CDMA network and a GSM network, 

42. (Original) Apparatus as claimed in claim 37, wherein said data channel is also 
used for passing text messages. 

43. (Original) Apparatus as claimed in claim 42, wherein said text messages are SMS 
messages. 

44. (Original) Apparatus as claimed in claim 37, wherein said step of transferring is 
initiated from a source of said malware definition updating data. 

45. (Original) Apparatus as claimed in claim 37, wherein said data channel is open 
whenever said mobile data processing device is switched on and connected to said public 
wireless telephony network. 

46. ; (Currently Amended) Apparatus for controlling a computer to initiate updating of 
malware definition data for a malware scanner of a mobile data processing device, said 
apparatus comprising: 

(i) link establishing logic operable to establish a wireless telephony link to said 
mobile data processing device via a public wireless telephony network; and 

(ii) update sending logic operable to send malware definition updating data to said 
mobile data processing device via a data channel of said wireless telephony link; 

wherein said mobile data processing device registers with a base station of said 
wireless telephony network when said link is established such that said base station and 
fraid wireless telephony ficfrvork are notified of a telephone number Qf ,gaid mobile data 
processing device for use in sending said malware definition updating data to said mobile 
data processing device: 

wherein when received data is received at said mobile data processing device, a 
type of said received data is identified to determine if said received data is said malware 
definition updating data, such that if said received data is said malware definition 
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updating data, a digital signature associated with said malware definition updating data is 
verified; 

wherein if said digital signature is not verified, said malware definition updating 
data is ignored: 

wherein if said digital signature is verified, said malware defi nition updating data 
is utilized to update malware definition data stored upon said mobile da ta processing 
device by appending said malware definition updating data to said malwar e definition 
data: 

wherein said malware definition updating data is provided in a malware definition 
updating file, where said file is generated bv one of automatically, se mi-automaticallv. 
and manually upon an analysis of newly discovered malware and wh ere said file includes 
a detection fingerprint, and at least one of a removal action and a d isinfection action to be 
taken in response to a detection of said newly discovered malware; 

wherein said mobile data processing device is identified bv a database of 
subscribers to an update service associated with said malware s^ nn^ w here said 
database includes said telephone number of said mobile data processing de vice to which 
said malware definition updating data is to be sent and a type of said mobile data 
processing device such that only malware definition updating data that is app ropriate to 
said type of said mobile data processing device is sent to said mobile data processing 
device . 

47. (Original) Apparatus as claimed in claim 46, wherein said mobile data processing 
device is a mobile telephone. 

48. (Original) Apparatus as claimed in claim 46, wherein said mobile data processing 
device is a personal digital assistant having a connection to said wireless public telephony 
network. 

49. (Cancelled) 

50. (Original) Apparatus as claimed in claim 46, wherein said public wireless 
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telephone network is one of a CDMA network and a GSM network. 

51 . (Original) Apparatus as claimed in claim 46, wherein said data channel is also 
used for passing text messages. 

52. (Original) Apparatus as claimed in claim 51, wherein said text messages are SMS 
messages. 

53. (Original) Apparatus as claimed in claim 46, wherein transfer of malware 
definition updating data is initiated from a source of said malware definition updating 
data. 

54. (Original) Apparatus as claimed in claim 46, wherein said data channel is open 
whenever said mobile data processing device is switched on and connected to said public 
wireless telephony network. 
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